From: Steve Grubb <sgrubb@redhat.com>
To: linux-audit@redhat.com
Subject: Re: Number of TTY events vs Number of USER_TTY events
Date: Fri, 09 Aug 2019 16:48:47 -0400 [thread overview]
Message-ID: <2798894.CVzZM77eHU@x2> (raw)
In-Reply-To: <AC213336-71F2-4FC4-9712-AFB7E62EB07B@pnnl.gov>
On Wednesday, August 7, 2019 6:13:19 PM EDT Smith, Gary R wrote:
> I have TTY auditing set up on a number of hosts using pam_tty_audit for the
> root account. I have this line in a PAM file to enable it:
> session required pam_tty_audit.so disable=* enable=root
>
> In looking at the reports from aureport and ausearch, the number of TTY
> events is always equal to the number of USER_TTY events. For instance:
> # ausearch -i -m TTY -ts today | wc -l ; ausearch -i -m USER_TTY -ts today
> | wc -l
> 20
> 20
>
> I started wondering, “Are there always the same number of these two event
> types?” I tried constructing some synthetic cases to see if there is a
> case where there isn’t an equal number of the two events. I couldn’t
> construct such a case. Is there a case of cases where the two type event
> types aren’t of equal number?
I think that is just a coincidence. I don't think there is any attempt to
keep them in sync. For example, if you open a document and edit it for a long
time, you will probably get them out of sync because the bash based one loses
visibility of what's happening in the document editor. Meanwhile the kernel
still sees everything.
-Steve
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
prev parent reply other threads:[~2019-08-09 20:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-07 22:13 Number of TTY events vs Number of USER_TTY events Smith, Gary R
2019-08-09 20:48 ` Steve Grubb [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2798894.CVzZM77eHU@x2 \
--to=sgrubb@redhat.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.